Name: CVE-2019-7146: Out-of-bounds Read
Creator: Rapid7
Published: 2019-01-29T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2019-7146, CWE-125, CVSS 5.5, EPSS 0.0152

In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as demonstrated by eu-readelf.

CVSS Details

CVSS 3.1 Base Score: 5.5
CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade elfutils	Aug 22, 2024	Jan 29, 2019
Centos_linux	—	Upgrade elfutils-libsUpgrade elfutils-debugsourceUpgrade elfutils-libs-debuginfoUpgrade elfutils-debuginfoUpgrade elfutils-libelfUpgrade elfutils-libelf-develUpgrade elfutils-libelf-debuginfoUpgrade elfutils-default-yama-scopeUpgrade elfutils-develUpgrade elfutils	Nov 6, 2019	Jan 29, 2019
Debian	—	Upgrade elfutils	Feb 14, 2019	Feb 14, 2019
Oracle_linux	—	Upgrade elfutils-libelfUpgrade elfutils-default-yama-scopeUpgrade elfutils-devel-staticUpgrade elfutils-develUpgrade elfutils-libelf-devel-staticUpgrade elfutilsUpgrade elfutils-libsUpgrade elfutils-libelf-devel	Oct 5, 2022	Jan 9, 2019
Redhat_linux	—	Upgrade elfutils-develUpgrade elfutils-libsUpgrade elfutilsUpgrade elfutils-libs-debuginfoUpgrade elfutils-libelf-devel-staticUpgrade elfutils-libelf-develUpgrade elfutils-devel-staticUpgrade elfutils-libelfUpgrade elfutils-debugsourceUpgrade elfutils-libelf-debuginfoUpgrade elfutils-default-yama-scopeUpgrade elfutils-debuginfo	Nov 6, 2019	Jan 29, 2019
Suse	—	Upgrade libasm-develUpgrade libdw-develUpgrade libelf-develUpgrade libdw1Upgrade elfutilsUpgrade libasm1-32bitUpgrade libebl-plugins-32bitUpgrade libasm1Upgrade libdwarves-develUpgrade libdw1-32bitUpgrade libdwarves1-32bitUpgrade libelf-devel-32bitUpgrade libdwarves-devel-32bitUpgrade libelf1-32bitUpgrade libebl-pluginsUpgrade libelf1Upgrade libdwarves1Upgrade elfutils-langUpgrade dwarvesUpgrade libebl-devel	Aug 9, 2024	Jan 29, 2019

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence